{ "id": "CB-UBU-AUTH-002", "standard": "ubuntu", "version": "0.1.0", "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-002", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-002.json", "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-002.yml", "profiles_effective": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-UBU-AUTH-002", "title": "Keep system details out of the message of the day", "finding": { "title": "The message of the day shows the operating system version and kernel release to every user who logs in", "description": "Every login session, including a compromised account, learns the exact release and kernel to target." }, "status": "active", "profiles": [ "core" ], "risk": { "severity": "low" }, "assessment": "automated", "tags": [ "banner", "login", "motd" ], "description": "After login, `pam_motd` shows `/etc/motd` and a dynamic message built by running the executable\nscripts of `/etc/update-motd.d/` with `run-parts`. On Ubuntu, `00-header` prints the full\ndistribution version and the kernel name, release and architecture\n(`Welcome to Ubuntu 24.04.5 LTS (GNU/Linux 6.8.0-147-generic x86_64)`), and some other scripts\ncan repeat the version (on 20.04, the ESM notice of `91-contract-ua-esm-status`).\n\nThis control runs the dynamic message as `pam_motd` does and checks that its output names\nneither the running kernel release nor the `Ubuntu ` of the system.\n", "rationale": "The kernel release and the exact distribution version tell an attacker who reached a shell, or\nwho only watches a session, which local privilege escalation exploits apply. There is no need\nto show them to every user at every login.\n", "impact": "Users no longer see the welcome line with the version and kernel at login, nor any other\nscript that printed them. They can still run `uname -a` or `lsb_release -a`. The other parts of\nthe message (help links, system load, pending updates) are kept.\n", "notes": "The fix records the new mode with `dpkg-statoverride`, so a package upgrade (for example of\n`base-files`, which owns `00-header`) does not make the script executable again. Ubuntu ships no\n`/etc/motd`; its check only applies when an administrator created one.\n", "setting": { "location": "/etc/motd, /etc/update-motd.d/00-header", "default_value": "00-header executable, no /etc/motd", "recommended_value": "Scripts that print the version or kernel not executable, /etc/motd without OS details" }, "audit": { "manual": "1. If `/etc/motd` exists, it must not contain the escape sequences `\\m`, `\\r`, `\\s`, `\\v` or\n `Ubuntu` followed by a version.\n2. Run `run-parts --lsbsysinit /etc/update-motd.d` as root. The output must not contain the\n result of `uname -r`, nor `Ubuntu` followed by the `VERSION_ID` of `/etc/os-release`.\n", "checks": [ { "id": "motd-no-os", "engine": "file-content", "description": "/etc/motd does not reveal the system version (not applicable when absent).", "spec": { "path": "/etc/motd", "pattern": "\\\\[mrsv]|Ubuntu [0-9]", "expect": "no_match" } }, { "id": "dynamic-motd", "engine": "shell", "description": "Output of the dynamic MOTD scripts, as built by pam_motd.", "spec": { "script": "[ -d /etc/update-motd.d ] || { echo \"no /etc/update-motd.d\"; exit 2; }\nv=$(. /etc/os-release && printf '%s' \"$VERSION_ID\")\nk=$(uname -r)\nhits=$(timeout 120 run-parts --lsbsysinit /etc/update-motd.d 2>/dev/null | grep -F -e \"$k\" -e \"Ubuntu $v\")\nif [ -n \"$hits\" ]; then printf '%s\\n' \"$hits\" | head -n 3; exit 1; fi\necho \"no kernel release or Ubuntu $v in the dynamic MOTD\"\n" } } ] }, "remediation": { "manual": "1. For each script of `/etc/update-motd.d/` whose output shows the version or the kernel\n (`00-header` by default), remove the execute bit in a way that survives upgrades:\n `dpkg-statoverride --update --add root root 0644 /etc/update-motd.d/00-header`.\n2. Remove OS names, versions and escape sequences from `/etc/motd`, if it exists.\n", "effects": { "restart": "none", "disruption": "none", "lockout_risk": false }, "rollback": "For each changed script: `dpkg-statoverride --remove /etc/update-motd.d/